mirror of
https://github.com/marcredhat/SIEM-toolkit-patched
synced 2026-06-09 21:07:15 +00:00
marc
a9dcf48e65
The original upstream gitignores parsers/* on the assumption that each tenant has its own set. This fork commits a working snapshot so the Parser Test Runner and Parser Coverage features are usable out of the box. Stormshield parser exercises the new SDL key=value scanner, pattern references, and JS-style unquoted format keys added to backend/routers/quality.py.
73 lines
2.8 KiB
Plaintext
73 lines
2.8 KiB
Plaintext
{
|
|
// Palo Alto PAN-OS CSV parser — OCSF v1.3.0
|
|
// Format: domain,receive_time,serial,type,subtype,...,src_ip,dst_ip,natsrc_ip,natdst_ip,rule,...
|
|
attributes: {
|
|
"metadata.version": "1.3.0",
|
|
"metadata.product.vendor_name": "Palo Alto Networks",
|
|
"metadata.product.name": "PAN-OS",
|
|
"Category": "network",
|
|
"dataSource.vendor": "Palo Alto Networks",
|
|
"dataSource.name": "PAN-OS",
|
|
"dataSource.category": "firewall",
|
|
"category_uid": 4,
|
|
"category_name": "Network Activity",
|
|
"class_uid": 4001,
|
|
"class_name": "Network Activity",
|
|
"activity_id": 6,
|
|
"type_uid": 400106,
|
|
"status_id": 1,
|
|
"status": "Success",
|
|
"severity_id": 1
|
|
},
|
|
|
|
patterns: {
|
|
word: "[^,]*",
|
|
csv: "[^,]+"
|
|
},
|
|
|
|
formats: [
|
|
// TRAFFIC log
|
|
{
|
|
id: "panos_traffic",
|
|
attributes: {
|
|
class_uid: 4001, class_name: "Network Activity",
|
|
type_uid: 400106
|
|
},
|
|
format: "$domain=csv$,$receive_time=csv$,$serial=csv$,TRAFFIC,$subtype=csv$,$config_ver=csv$,$gen_time=csv$,$src_ip=csv$,$dst_ip=csv$,$natsrc_ip=word$,$natdst_ip=word$,$rule=csv$,$src_user=word$,$dst_user=word$,$application=csv$,.*",
|
|
halt: true
|
|
},
|
|
|
|
// THREAT log → Detection Finding
|
|
{
|
|
id: "panos_threat",
|
|
attributes: {
|
|
class_uid: 2004, class_name: "Detection Finding",
|
|
category_uid: 2, category_name: "Findings",
|
|
type_uid: 200401,
|
|
finding_title: "Palo Alto Threat Detected",
|
|
severity_id: 5, severity: "Critical",
|
|
disposition_id: 2, disposition: "Blocked"
|
|
},
|
|
format: "$domain=csv$,$receive_time=csv$,$serial=csv$,THREAT,$threat_subtype=csv$,$config_ver=csv$,$gen_time=csv$,$src_ip=csv$,$dst_ip=csv$,$natsrc_ip=word$,$natdst_ip=word$,$rule=csv$,$src_user=word$,$dst_user=word$,$application=csv$,.*",
|
|
halt: true,
|
|
rewrites: [
|
|
{ input: "threat_subtype", output: "finding_title", match: "(?i)^.*vulnerability.*$", replace: "Palo Alto Vulnerability Exploit Attempt" },
|
|
{ input: "threat_subtype", output: "finding_title", match: "(?i)^.*virus.*$", replace: "Palo Alto Malware Detected" },
|
|
{ input: "threat_subtype", output: "finding_title", match: "(?i)^.*spyware.*$", replace: "Palo Alto Spyware/C2 Detected" },
|
|
{ input: "threat_subtype", output: "finding_title", match: "(?i)^.*url.*$", replace: "Palo Alto Malicious URL" }
|
|
]
|
|
},
|
|
|
|
// URL filtering log
|
|
{
|
|
id: "panos_url",
|
|
attributes: {
|
|
class_uid: 4002, class_name: "HTTP Activity",
|
|
type_uid: 400201
|
|
},
|
|
format: "$domain=csv$,$receive_time=csv$,$serial=csv$,URL,.*",
|
|
halt: true
|
|
}
|
|
]
|
|
}
|